querysource 4.4.2__tar.gz → 4.5.0__tar.gz

{querysource-4.4.2 → querysource-4.5.0}/Makefile

@@ -1,7 +1,7 @@
 # QuerySource Makefile
 # This Makefile provides a set of commands to manage the QuerySource project.
 
-.PHONY: venv install develop setup dev release format lint test clean distclean lock sync build-rust
+.PHONY: venv install develop setup dev release format lint test clean distclean lock sync build-rust stage-rust
 
 # Python version to use
 PYTHON_VERSION := 3.11
@@ -38,6 +38,7 @@ endif
 # Install all dependencies including dev dependencies
 develop: build-rust
 	uv sync --frozen --extra analytics --extra dev
+	$(MAKE) build-inplace
 
 # Build the Rust-accelerated parser extension (querysource.qs_parsers._qs_parsers)
 # Use --manifest-path so maturin reads rust/pyproject.toml (build-backend = maturin),
@@ -47,6 +48,25 @@ build-rust:
 	@command -v maturin >/dev/null 2>&1 || uv pip install maturin
 	maturin develop --release --manifest-path rust/Cargo.toml
 
+# Stage the compiled Rust extension (.so) INTO the source tree so that
+# `uv build` (setuptools backend) bundles it into the wheel. setuptools only
+# packages a pre-existing artifact via package-data
+# ("querysource.qs_parsers" = ["*.so", "*.pyd"]); it never invokes maturin.
+# `maturin develop` installs into the venv (site-packages), NOT the source
+# tree, so the wheel would otherwise ship without the Rust extension.
+RUST_WHEEL_OUT := target/wheels
+stage-rust:
+	@command -v maturin >/dev/null 2>&1 || uv pip install maturin
+	maturin build --release -i python --manifest-path rust/Cargo.toml --out $(RUST_WHEEL_OUT)
+	@whl=$$(ls -t $(RUST_WHEEL_OUT)/qs_parsers-*.whl | head -1); \
+	  test -n "$$whl" || { echo "ERROR: maturin produced no wheel in $(RUST_WHEEL_OUT)"; exit 1; }; \
+	  echo "Staging Rust extension from $$whl"; \
+	  tmp=$$(mktemp -d); \
+	  unzip -o -q "$$whl" -d "$$tmp"; \
+	  find "$$tmp" -name '_qs_parsers*.so' -exec cp {} querysource/qs_parsers/ \; ; \
+	  rm -rf "$$tmp"; \
+	  ls -la querysource/qs_parsers/_qs_parsers*.so
+
 # Alternative: install without lock file (faster for development)
 develop-fast:
 	uv pip install -e .[analytics,dev]
@@ -113,8 +133,13 @@ build-inplace:
 	@echo "Building Cython extensions in place..."
 	python setup.py build_ext --inplace
 
-# Full build using uv
+# Full build using uv.
+# Order matters: `clean` wipes every *.so, so the Rust extension must be
+# (re)staged AFTER clean and BEFORE `uv build` packages the wheel. Running
+# stage-rust from the recipe (not as a prerequisite) guarantees that order
+# even under `make -j`.
 build: clean
+	$(MAKE) stage-rust
 	@echo "Building package with uv..."
 	uv build
 

{querysource-4.4.2/querysource.egg-info → querysource-4.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: querysource
-Version: 4.4.2
+Version: 4.5.0
 Summary: Aiohttp web service for querying several databases easily
 Author-email: Jesus Lara <jesuslarag@gmail.com>
 License: BSD-3-Clause

querysource-4.5.0/generated/NormalizeColumns.json

@@ -0,0 +1,78 @@
+{
+  "name": "NormalizeColumns",
+  "category": "Transformations",
+  "description": "Normalize every column name into a database-safe identifier (lowercase, accent-stripped, symbols collapsed to an underscore, truncated to a maximum length, collisions de-duplicated).",
+  "usage": "Drop it as a ``Transform`` step before a table/database destination. With no parameters it applies safe defaults (lowercase, strip accents, 63-byte max). Use ``overrides`` to pin specific source columns to an exact target name.",
+  "attributes": [
+    {
+      "name": "max_length",
+      "type": "int",
+      "default": 63,
+      "required": false,
+      "description": "Maximum identifier length. Defaults to 63 (the PostgreSQL identifier byte limit)."
+    },
+    {
+      "name": "case",
+      "type": "str",
+      "default": "lower",
+      "required": false,
+      "description": "Case handling: \"lower\", \"upper\" or \"preserve\"."
+    },
+    {
+      "name": "strip_accents",
+      "type": "bool",
+      "default": true,
+      "required": false,
+      "description": "Remove diacritics (\"Regi\u00f3n\" -> \"region\")."
+    },
+    {
+      "name": "replacement",
+      "type": "str",
+      "default": "_",
+      "required": false,
+      "description": "String that replaces runs of non-alphanumeric characters."
+    },
+    {
+      "name": "overrides",
+      "type": "dict",
+      "default": null,
+      "required": false,
+      "description": "Mapping {original_name: target_name} pinning specific source columns to an exact name, bypassing normalization for those columns."
+    }
+  ],
+  "json_schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "title": "NormalizeColumns",
+    "type": "object",
+    "properties": {
+      "max_length": {
+        "type": "integer",
+        "description": "Maximum identifier length. Defaults to 63 (the PostgreSQL identifier byte limit).",
+        "default": 63
+      },
+      "case": {
+        "type": "string",
+        "description": "Case handling: \"lower\", \"upper\" or \"preserve\".",
+        "default": "lower"
+      },
+      "strip_accents": {
+        "type": "boolean",
+        "description": "Remove diacritics (\"Regi\u00f3n\" -> \"region\").",
+        "default": true
+      },
+      "replacement": {
+        "type": "string",
+        "description": "String that replaces runs of non-alphanumeric characters.",
+        "default": "_"
+      },
+      "overrides": {
+        "type": "object",
+        "description": "Mapping {original_name: target_name} pinning specific source columns to an exact name, bypassing normalization for those columns."
+      }
+    },
+    "additionalProperties": true,
+    "description": "Normalize all column names into database-safe identifiers. All attributes are optional; with no parameters safe defaults are applied."
+  },
+  "example": "{\"Transform\": [{\"NormalizeColumns\": {}}]}",
+  "icon": "shuffle"
+}

{querysource-4.4.2 → querysource-4.5.0}/generated/S3Source.json

@@ -71,6 +71,6 @@
     },
     "required": []
   },
-  "example": "{\n    \"credentials\": {\n        \"region_name\": \"AWS_REGION_NAME\",        # navconfig var or literal\n        \"bucket\": \"AWS_PLACER_BUCKET\",\n        \"aws_key\": \"AWS_ACCESS_KEY_ID\",\n        \"aws_secret\": \"AWS_SECRET_ACCESS_KEY\"\n    },\n    \"source\": {\n        \"file\": \"metrics_2024-12-09_0003.csv.gz\",\n        \"directory\": \"placer-analytics/bulk-export/\"\n    }\n}",
+  "example": "{\n  \"credentials\": {\n    \"region_name\": \"AWS_REGION_NAME\",\n    \"bucket\": \"AWS_PLACER_BUCKET\",\n    \"aws_key\": \"AWS_ACCESS_KEY_ID\",\n    \"aws_secret\": \"AWS_SECRET_ACCESS_KEY\"\n  },\n  \"source\": {\n    \"file\": \"metrics_2024-12-09_0003.csv.gz\",\n    \"directory\": \"placer-analytics/bulk-export/\"\n  }\n}",
   "icon": "database"
 }

{querysource-4.4.2 → querysource-4.5.0}/generated/SharepointSource.json

@@ -32,6 +32,13 @@
       "required": false,
       "description": ""
     },
+    {
+      "name": "credentials.tenant_host",
+      "type": "Any",
+      "default": "",
+      "required": false,
+      "description": ""
+    },
     {
       "name": "credentials.site",
       "type": "Any",
@@ -52,6 +59,20 @@
       "default": "",
       "required": false,
       "description": ""
+    },
+    {
+      "name": "source.sheet_name",
+      "type": "Any",
+      "default": 0,
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "source.pd_args",
+      "type": "Any",
+      "default": {},
+      "required": false,
+      "description": ""
     }
   ],
   "json_schema": {
@@ -66,6 +87,7 @@
           "client_secret": {},
           "tenant_id": {},
           "tenant_name": {},
+          "tenant_host": {},
           "site": {}
         }
       },
@@ -73,12 +95,14 @@
         "type": "object",
         "properties": {
           "filename": {},
-          "directory": {}
+          "directory": {},
+          "sheet_name": {},
+          "pd_args": {}
         }
       }
     },
     "required": []
   },
-  "example": "{\n    \"credentials\": {\n        \"client_id\": \"SHAREPOINT_APP_ID\",        # navconfig var or literal\n        \"client_secret\": \"SHAREPOINT_APP_SECRET\",\n        \"tenant_id\": \"SHAREPOINT_TENANT_ID\",\n        \"tenant_name\": \"mytenant\",               # optional, defaults to \"sharepoint\"\n        \"site\": \"Roadshows\"\n    },\n    \"source\": {\n        \"filename\": \"2025 Events Master Schedule.xlsx\",\n        \"directory\": \"Shared Documents/General/Schedule\"\n    }\n}",
+  "example": "{\n  \"credentials\": {\n    \"client_id\": \"SHAREPOINT_APP_ID\",\n    \"client_secret\": \"SHAREPOINT_APP_SECRET\",\n    \"tenant_id\": \"SHAREPOINT_TENANT_ID\",\n    \"tenant_name\": \"mytenant\",\n    \"site\": \"Roadshows\"\n  },\n  \"source\": {\n    \"filename\": \"2025 Events Master Schedule.xlsx\",\n    \"directory\": \"Shared Documents/General/Schedule\"\n  }\n}",
   "icon": "database"
 }

{querysource-4.4.2 → querysource-4.5.0}/generated/SmartSheetSource.json

@@ -42,6 +42,6 @@
     },
     "required": []
   },
-  "example": "{\n    \"credentials\": {\n        \"api_key\": \"SMARTSHEET_API_KEY\"   # navconfig var or literal\n    },\n    \"source\": {\n        \"file_id\": 8504624500658052\n    }\n}",
+  "example": "{\n  \"credentials\": {\n    \"api_key\": \"SMARTSHEET_API_KEY\"\n  },\n  \"source\": {\n    \"file_id\": 8504624500658052\n  }\n}",
   "icon": "database"
 }

{querysource-4.4.2 → querysource-4.5.0}/generated/TableSource.json

@@ -40,6 +40,6 @@
       "table"
     ]
   },
-  "example": "{\n    \"driver\": \"pg\",\n    \"schema\": \"troc\",\n    \"table\": \"stores\",\n    \"filter\": {\"active\": true},\n    \"credentials\": {         # optional\n        \"host\": \"localhost\",\n        \"port\": 5432,\n        \"user\": \"myuser\",\n        \"password\": \"mypassword\",\n        \"database\": \"mydb\"\n    }\n}",
+  "example": "{\n  \"driver\": \"pg\",\n  \"schema\": \"troc\",\n  \"table\": \"stores\",\n  \"filter\": {\n    \"active\": true\n  },\n  \"credentials\": {\n    \"host\": \"localhost\",\n    \"port\": 5432,\n    \"user\": \"myuser\",\n    \"password\": \"mypassword\",\n    \"database\": \"mydb\"\n  }\n}",
   "icon": "database"
 }

{querysource-4.4.2 → querysource-4.5.0}/generated/ToSharepoint.json

@@ -33,6 +33,6 @@
     },
     "required": []
   },
-  "example": "Output:\n  - ToSharepoint:\n      credentials:\n        client_id: SHAREPOINT_APP_ID\n        client_secret: SHAREPOINT_APP_SECRET\n        tenant_id: SHAREPOINT_TENANT_ID\n        site: Roadshows\n      destination:\n        filename: \"2025 Events Master Schedule.xlsx\"\n        directory: \"Shared Documents/General/Schedule\"",
+  "example": "{\n  \"Output\": [\n    {\n      \"ToSharepoint\": {\n        \"credentials\": {\n          \"client_id\": \"SHAREPOINT_APP_ID\",\n          \"client_secret\": \"SHAREPOINT_APP_SECRET\",\n          \"tenant_id\": \"SHAREPOINT_TENANT_ID\",\n          \"site\": \"Roadshows\"\n        },\n        \"destination\": {\n          \"filename\": \"2025 Events Master Schedule.xlsx\",\n          \"directory\": \"Shared Documents/General/Schedule\"\n        }\n      }\n    }\n  ]\n}",
   "icon": "upload-cloud"
 }

querysource-4.5.0/policies/HARDENING.md

@@ -0,0 +1,230 @@
+# QuerySource PBAC — Política de Endurecimiento
+
+Guía para migrar desde la *baseline permisiva* (`baseline.yaml`) hacia un control
+de acceso de mínimo privilegio, sin interrumpir la operación en ningún paso.
+
+> Aplica con `QS_PBAC_ENABLED=True`. Todos los archivos `policies/*.yaml` se
+> fusionan en un único conjunto al arranque. Cambiar un YAML requiere
+> **reiniciar el servicio** (o disparar un `reload()` explícito).
+
+---
+
+## 1. Reglas del motor (lo que debes tener presente)
+
+Por cada request QS evalúa `(resource_type, resource_name, action)`. El motor Rust
+(`rs_pep`) decide así:
+
+1. Conserva las políticas que matchean **tenant + resource + action + subject + environment**.
+2. **`enforcing: true`** → la primera que matchea (mayor `priority`) decide al instante.
+3. Si no hay enforcing → gana el mejor `allow` vs. el mejor `deny`:
+   **el allow gana solo si su `priority` es estrictamente mayor; el deny gana en empate.**
+4. Si nada matchea → `ABAC_DEFAULT_EFFECT` (env, default **`deny`**).
+
+Capa del handler QS: **sin sesión autenticada → 404 siempre** (fail-closed),
+independientemente de las políticas.
+
+### Semántica de matching
+
+| Campo | Vacío / omitido | Comodín | Notas |
+|-------|-----------------|---------|-------|
+| `resources` | matchea **todos** | `"*"` o `"*:*"` | debe ser `tipo:patrón`; glob (`*` `?`) y regex. Un token sin `:` **no matchea nada**. |
+| `actions` | matchea **todas** | `"*"` | exacto o `*`. |
+| `subjects` | `groups`+`users`+`roles` vacíos → **todos** | `groups: ["*"]` → todos | `exclude_*` se evalúa primero: pertenecer = no-match inmediato. |
+
+**Tipos de recurso**: `slug`, `datasource`, `driver`, `raw_query`.
+**Acciones en uso**: `slug:execute`, `slug:list`, `slug:read`, `datasource:use`,
+`datasource:list`, `driver:use`, `driver:list`, `raw_query:execute`.
+
+> `effect` debe ir en **minúsculas** (`allow` / `deny`).
+
+---
+
+## 2. Estrategia de endurecimiento progresivo
+
+La baseline (`authenticated_allow_all`, priority 1, non-enforcing) es un **piso**.
+Endurecer = colocar políticas con **priority mayor** que la corrijan, en este orden:
+
+```
+priority 100  enforcing  →  admin_full_access      (intocable; admins siempre pasan)
+priority  90  enforcing  →  service accounts        (CI/CD, bots)
+priority  50             →  deny duros              (raw_query, recursos sensibles)
+priority  30             →  allow específicos       (grupo ↔ recurso)
+priority   1  non-enforc →  authenticated_allow_all (baseline; se elimina al final)
+```
+
+**Tácticas clave (derivadas de las reglas del motor):**
+
+- **Deny gana en empate** → para prohibir algo a *casi* todos pero permitir a un
+  grupo, da al `allow` una `priority` mayor que la del `deny` (no igual).
+- **`enforcing: true` corta** → úsalo solo para reglas absolutas (admin, o un
+  deny de cumplimiento que nadie debe poder sobreescribir). No lo uses en reglas
+  que quieras poder matizar después.
+- **Migra por recurso**, no de golpe: añade políticas explícitas, observa los
+  `PBAC denied` en logs, y solo cuando todo grupo legítimo tenga su `allow`
+  explícito, **elimina `baseline.yaml`** (ese borrado es el que activa el
+  mínimo privilegio real: lo no permitido pasa a deny por default).
+
+---
+
+## 3. Ejemplos de políticas de endurecimiento
+
+### 3.1 Bloquear raw queries para todos salvo data-engineers
+
+`raw_queries.yaml`:
+
+```yaml
+version: "1.0"
+defaults:
+  effect: deny
+policies:
+  # Deny duro para cualquiera: tapa la baseline (priority 1).
+  - name: deny_raw_queries_default
+    effect: deny
+    description: "Las raw queries (SQL inline) están prohibidas por defecto."
+    resources: ["raw_query:*"]
+    actions: ["raw_query:execute"]
+    subjects:
+      groups: ["*"]
+    priority: 40
+
+  # Excepción: data-engineers SÍ pueden. priority > deny → el allow gana.
+  - name: allow_raw_queries_data_engineers
+    effect: allow
+    description: "Data engineers pueden ejecutar raw queries."
+    resources: ["raw_query:*"]
+    actions: ["raw_query:execute"]
+    subjects:
+      groups: ["data-engineers"]
+    priority: 50
+```
+
+### 3.2 Restringir un grupo a slugs con cierto prefijo
+
+`slugs.yaml`:
+
+```yaml
+version: "1.0"
+defaults:
+  effect: deny
+policies:
+  # Analysts solo ven/ejecutan slugs "finance_*".
+  - name: analysts_finance_slugs
+    effect: allow
+    description: "Analysts ejecutan y listan únicamente slugs finance_*."
+    resources: ["slug:finance_*"]
+    actions: ["slug:execute", "slug:list", "slug:read"]
+    subjects:
+      groups: ["analysts"]
+    priority: 30
+
+  # Cualquier slug que NO sea finance_* queda denegado para analysts.
+  - name: analysts_deny_other_slugs
+    effect: deny
+    description: "Analysts no acceden a slugs fuera de finance_*."
+    resources: ["slug:*"]
+    actions: ["slug:execute", "slug:list", "slug:read"]
+    subjects:
+      groups: ["analysts"]
+    priority: 35   # > 30: este deny gana sobre la baseline y acota el allow anterior
+```
+
+> Mientras `baseline.yaml` siga presente, los analysts conservan acceso amplio por
+> el piso (priority 1) salvo donde un deny de mayor priority los acote. El recorte
+> total ocurre al **eliminar la baseline**.
+
+### 3.3 Datasource/driver sensible: solo lectura para un grupo
+
+`datasources.yaml`:
+
+```yaml
+version: "1.0"
+defaults:
+  effect: deny
+policies:
+  - name: deny_prod_db_default
+    effect: deny
+    description: "El datasource de producción está vetado por defecto."
+    resources: ["datasource:prod_*"]
+    actions: ["datasource:use", "datasource:list"]
+    subjects:
+      groups: ["*"]
+    priority: 40
+
+  - name: allow_prod_db_reporting
+    effect: allow
+    description: "Solo el grupo reporting usa los datasources prod_*."
+    resources: ["datasource:prod_*"]
+    actions: ["datasource:use", "datasource:list"]
+    subjects:
+      groups: ["reporting"]
+      exclude_groups: ["contractors"]   # ni siquiera si están en reporting
+    priority: 50
+```
+
+### 3.4 Cuenta de servicio (CI/CD) — acceso total, inamovible
+
+`superusers.yaml`:
+
+```yaml
+version: "1.0"
+defaults:
+  effect: deny
+policies:
+  - name: service_account_ci
+    effect: allow
+    description: "Cuenta de servicio de CI/CD con acceso total."
+    resources: ["*:*"]
+    actions: ["*"]
+    subjects:
+      users: ["ci-service@acme.com"]
+    priority: 90
+    enforcing: true   # corta: ninguna política posterior puede degradarla
+```
+
+### 3.5 Restricción por atributo de entorno (horario laboral)
+
+```yaml
+  - name: analysts_business_hours_only
+    effect: allow
+    description: "Analysts ejecutan slugs solo en horario laboral."
+    resources: ["slug:*"]
+    actions: ["slug:execute"]
+    subjects:
+      groups: ["analysts"]
+    conditions:
+      environment:
+        is_business_hours: true   # atributos disponibles: hour, dow,
+                                  # is_business_hours, is_weekend, day_segment
+    priority: 30
+```
+
+---
+
+## 4. Procedimiento de corte (de baseline a mínimo privilegio)
+
+1. **Inventaria** grupos y los recursos que cada uno usa hoy.
+2. Por cada recurso sensible, añade su `deny` (priority 40) + los `allow`
+   específicos (priority 30/50) — la baseline sigue de red de seguridad.
+3. Despliega, **reinicia**, y vigila los logs `PBAC denied` (info-level) y los
+   patrones de uso reales durante un periodo de observación.
+4. Cuando **todo grupo legítimo tenga su `allow` explícito**, elimina
+   `baseline.yaml` y reinicia. A partir de aquí, lo no permitido = **deny** por
+   default → mínimo privilegio efectivo.
+5. (Opcional) revisa que `ABAC_DEFAULT_EFFECT` siga en `deny`.
+
+## 5. Verificación
+
+Validar sintaxis y resumen de políticas cargadas:
+
+```bash
+python3 -c "
+import yaml, glob
+for f in sorted(glob.glob('policies/*.yaml')):
+    d = yaml.safe_load(open(f)) or {}
+    for p in d.get('policies', []):
+        print(f\"{p['priority']:>4} {'ENF' if p.get('enforcing') else '   '} \"
+              f\"{p['effect']:<5} {p['name']:<35} {p['resources']}\")
+" | sort -rn
+```
+
+Lee de mayor a menor priority: así ves el orden real de resolución.

querysource-4.5.0/policies/baseline.yaml

@@ -0,0 +1,35 @@
+version: "1.0"
+
+defaults:
+  effect: deny
+
+# ─── Soft baseline ──────────────────────────────────────────────────────────
+# Permite que QS_PBAC_ENABLED=True opere SIN hard-enforcement: cualquier usuario
+# autenticado puede usar todos los recursos de QuerySource. Los anónimos siguen
+# bloqueados (fail-closed en el handler → 404).
+#
+# Es un PISO, no un override: priority baja + enforcing:false para que cualquier
+# política posterior (deny o un allow más específico, con priority mayor) la
+# sobreescriba sin necesidad de borrar este archivo. El deny gana en empate; el
+# allow necesita priority estrictamente mayor.
+#
+# Para endurecer un recurso: añade un `deny` (o un `allow` más estrecho) con
+# priority > 1 en el archivo de ese recurso (slugs.yaml, datasources.yaml, …).
+# Cuando termines de migrar a políticas explícitas, elimina este archivo.
+# ────────────────────────────────────────────────────────────────────────────
+policies:
+  - name: authenticated_allow_all
+    effect: allow
+    description: >
+      Soft baseline: any authenticated user may use all QuerySource resources.
+      Lowest priority and non-enforcing so specific deny/allow policies override
+      it without removing this file. Anonymous requests are still denied (404).
+    resources:
+      - "*:*"
+    actions:
+      - "*"
+    subjects:
+      groups:
+        - "*"
+    priority: 1
+    enforcing: false

{querysource-4.4.2 → querysource-4.5.0}/policies/defaults.yaml

@@ -14,7 +14,7 @@ policies:
       - "slug:*"
       - "datasource:*"
       - "driver:*"
-      - "raw_query"
+      - "raw_query:*"
     actions:
       - "slug:execute"
       - "slug:list"

{querysource-4.4.2 → querysource-4.5.0}/querysource/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '4.4.3.dev0+g7613ad3de.d20260608'
-__version_tuple__ = version_tuple = (4, 4, 3, 'dev0', 'g7613ad3de.d20260608')
+__version__ = version = '4.5.1.dev0+gfd354d0c9.d20260619'
+__version_tuple__ = version_tuple = (4, 5, 1, 'dev0', 'gfd354d0c9.d20260619')
 
-__commit_id__ = commit_id = 'g7613ad3de'
+__commit_id__ = commit_id = 'gfd354d0c9'

{querysource-4.4.2 → querysource-4.5.0}/querysource/conf.py

@@ -366,6 +366,16 @@ DEFAULT_QUERY_FORMAT = config.get(
     fallback='native'
 )
 
+## Query parameters that must never reach the query parser.
+# Authentication/transport-related params (e.g. ?auth=..., ?apikey=...) get
+# appended to API URLs by upstream gateways/clients and would otherwise be
+# interpreted as query conditions/filters by QuerySource and MultiQuery.
+# Configurable via the EXCLUDED_QUERY_PARAMETERS env var (comma-separated).
+# Matched case-insensitively against query-parameter names.
+EXCLUDED_QUERY_PARAMETERS: set = {
+    p.strip().lower() for p in config.getlist('EXCLUDED_QUERY_PARAMETERS') if p.strip()
+} or {'auth', 'apikey', 'api_key', 'authorization'}
+
 ## Geoloc Support:
 GEOLOC_API_KEY = config.get('GEOLOC_API_KEY')